small refatoring and security improvements: if user try to login with email of existing local account, that is not bond to current social network, he will be asked for password to confirm binding (optional, see README `alwaysCheckPass`).
added $newUser variable to the hoauthAfterLogin() callback